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ABSTRACT 

The goal of this paper is to explore what resources are 
potentially available to safety panels and to provide 
some guidance on how to utilize those resources. While 
the examples used in this paper will concentrate on the 
Flight Equipment and Reliability Review Panel 
(FESRRP) and Extravehicular Activity (EVA) hardware 
that have come through that panel, as well as resources 
at Johnson Space Center, the paper will address how 
this applies to safety panels in general, and where 
possible cite examples for other safety panels. 

1. Introduction 

Due to the need for the independent evaluation of the 
safety of hardware and operations on manned 
spaceflight programs, these programs have established 
safety panels. The panels consist of representation from 
the various organizations within the program: the 
engineering directorate, the mission operations 
directorate (MOD), the life sciences directorate, the 
crew office, and the safety directorate. The program also 
has membership on the safety panel. Additional 
members are called in when appropriate, such as the 
EVA office when the hardware will be used in the EVA 
environment. The safety panels ensure that the 
hardware and operations meet program requirements for 
safety. Frequently, the safety panel review identifies 
hazards and needed controls that the hardware project 
did not develop during the initial safety assessment, in 
many cases due to the safety panels ability to look at the 
hardware or operation from a fresh, unbiased, vantage 
point, but also due to the familiarity of the safety 
requirements that the panel has obtained. 

Periodically, topics arise for which additional expertise 
is desired beyond that which the core panel members 
have. In the case of EVA hardware or EVA operations 
this is often the case. When additional insight is needed 
into the one hundred percent oxygen environment inside 
the suit, the safety panel can request additional insight 
from the White Sands Test Facility experts in high 
oxygen environments and/or the suit hardware experts. 
Another example would be requesting insight from the 
crew trainers for EVA operations for questions 
regarding the ability to avoid contacting a certain part of 
the hardware, such as when a sharp edge, shatterable 
material, or pinch point needs to be avoided. In either 
of these instances, the safety panel in question has 
resources to call upon to help answer these concerns. 


Also, it’s possible to ask for assistance with 
mechanisms concerns, structural failure questions, 
electronic failures, plasma, or thermal concerns, among 
others. If an integrated concern arises with hardware 
not addressed by the specific safety panel, it is possible 
to consult or have joint meetings with multiple safety 
panels to address the interfacing hardware. These 
resources are not always readily apparent to the safety 
community as a whole, but should be utilized to ensure 
the risks are well understood and documented prior to 
completion of the independent safety assessment by the 
program safety review panel. 

In an effort to clarify the need for experts to be 
consulted, several examples will be discussed. 

2. GFE 

The FESRRP reviews all Government Furnished 
Equipment (GFE) for flight safety. The periodically 
consults various experts to determine the appropriate 
controls and what level of risk should be documented 
for the Shuttle and ISS program. 

2.1. OBSS Lasers 



Figure 1. Inspection Sensors 


The Laser Dynamic Range Imager is one of the sensors 
which is part of the Orbiter Boom Sensor System 
(OBSS) used to provide on-orbit inspection of the 
Orbiter thermal protections system. The FESRRP 
consulted the JSC expert in non-ionizing radiation, 
when the question arose whether the laser was powerful 
enough to cause eye damage to the crew, both during 
EVA operations, and IVA when the Boom was close to 
the Orbiter windows. The engineering expert for the 
Orbiter windows was also consulted during this 
discussion to establish the transmittance properties of 



the window. The laser expert concurred with the 
hardware provider’s analysis for the necessary keep-out 
zone for the EVA crew and with the recommendation 
for the IVA crew to wear specific sunglasses when the 
LDRI was within the distance where eye damage was 
possible even with the window transmittance. 

The Laser Camera System (LCS) is the other sensor on 
the OBSS that uses a laser for imaging, and the 
FESRRP also consulted the JSC expert in non-ionizing 
radiation and received concurrence with the hardware 
providers recommended keep-out zone. Elowever, 
during the detailed test objective the Shuttle program 
used to establish the stability of the Boom as an EVA 
worksite for repair, it was necessary for the EVA crew 
to enter the keep-out zone for both sensors. To establish 
the necessary levels of controls, the safety panel had a 
joint meeting with the ISS Safety Review Panel as well 
as the Orbiter safety review panel. The safety panels 
also utilized the MOD EVA experts to address the 
operational controls and when entering the keep-out 
zones was necessary. This discussion resulted in 
agreement that the laser hazard was considered 
catastrophic for both sensors, with the assistance of the 
JSC non-ionizing radiation expert clarifying the power 
and potential results of loss of eyesight. This case 
demonstrates the need for experts in several different 
fields, the laser expert, the window expert, and the EVA 
operations experts, as well as the potential to consult 
other safety panels when integrated issues arise. 

2.2. RCC Plug Repair 

The Reinforced Carbon-Carbon (RCC) plug repair can 
be performed EVA to repair damage to the Orbiter 
RCC. The RCC plug repair assembly (PRA) consists of 
a flexible carbon silicon cover plate and an attachment 
mechanism used to attach and hold the cover plate to the 
Orbiter. During the safety panel assessment of the RCC 
plug assembly, several issues arose that required 
expertise beyond that of the nominal panel members. A 
materials expert was asked to help the panel understand 
the reaction of the PRA materials to re-entry heating 
and loads. Due to the fact that the Plug repair project 
used two separate arc-jet facilities during development 
testing and qualification testing, the panel also asked an 
expert in arc-jet testing to clarify how differences in the 
two facilities would effect the test results. Additionally, 
the MOD representative to the panel requested that the 
MOD EVA person responsible for training the crew and 
writing procedures for the RCC Plug repair attend and 
help discuss what training the crew nominally received, 
as well as confirming the feasibility of any operational 
controls suggested during the safety review. Without 
the assistance of all of these experts, the safety panel 
would not have been able to effectively determine what 
risk to document on the hazard reports for the ability to 
safely repair the Orbiter RCC. 


2.3. T-RAD 

The Tile Repair Ablator Dispenser (T-RAD) assembly 
is a tool that provides containment and a single use 
dispense of the Shuttle Tile Ablator (STA-54) material 
for use in a contingency tile repair. It is the second 
generation of tools for this task. 

For the previous tool, the safety panel consulted the 
toxicologists for an accurate assessment of the toxicity 
of the STA-54 components. One component had a 
material that separated out over time. This material was 
known by the toxicologists to be toxic, but had little 
testing or empirical data, so the toxicologists had to 
perform some additional testing to clarify the properties 
of the material, and detennine that the material was 
toxicity hazard level 2. This resulted in the need for 
additional levels of containment for the material during 
stowage in the Orbiter middeck, to prevent exposure to 
the cabin environment. Without consulting the 
toxicology experts in this case, the safety panel would 
not have been able to clarify the need for additional 
levels of containment, nor accurately document the level 
of risk. Outside expertise identified areas of increased 
risk, which required the programs to provide additional 
controls. 

Once the program decided to perform an on-orbit 
verification that the T-RAD could perform a repair, the 
safety panel had to assess the removal of the T-RAD 
from the additional levels of containment. This 
necessitated consulting with the EVA crew and the 
MOD personnel training the crew to ascertain what 
operational controls were viable to mitigate and control 
the risk of exposure during the short period of time 
needed to prepare for the EVA. While the safety panel 
representative for the EVA office and the crew could 
have coordinated with both parties outside the panel 
meeting, it was much more time effective to have those 
people present. Being part of the discussion also 
allowed the MOD personnel to understand the rationale 
behind the controls, such as the need to examine the T- 
RAD for fluid leakage prior to removal from the outer 
bags. The on-orbit test was successfully performed 
without exposing the crew to the toxic material. 

2.4. ERAD 

The Enhanced Right Angle Drive (ERAD) is an EVA 
tool constructed with drive shafts and gearing to receive 
an input torque and apply an output torque 
perpendicular to the direction of the input. It was 
developed to overcome the shortcomings of the Right 
Angle Drive (RAD) currently used for ISS tasks 
because the RAD has inconsistent output, excessive 
drive train gear wear, restricted capabilities, and a 
limited cycle life. 



The safety panel has had some initial meetings with the 
ERAD project, although it has not completed the safety 
process. During these initial meetings, the safety panel 
directed the project to consult with the Mechanical 
Systems Working Group (MSWG) to determine 
whether ERAD could be considered design for 
minimum risk (DFMR) for breaking torques. The 
MSWG is also providing direction to the ERAD project 
to help determine the appropriate cycle testing including 
side load testing. 

Considering the nature of the ERAD hardware, it is 
important to involve the MSWG early in the 
discussions, and to make sure their input is considered 
during the safety panel discussions. 

2.5. PTU Straps 

Due to the large volume of the JEM module, the Pan 
Tilt Unit (PTU) located on the elbow of the RMS was at 
risk of contacting the JEM module or Orbiter radiator 
during the launch phase of STS- 124. The PTU strap 
was designed and built to prevent the PTU from moving 
enough during the launch to on-orbit phase of the flight 
to contact either the JEM or radiator. The PTU strap 
consisted of elastic straps and hook and pile to aid in the 
ease of removal during EVA, so that the PTU could be 
used for situational awareness during RMS maneuvers 
later in the flight. Due to the fact that hook and pile is 
not generally used to withstand vibration launch loads, 
the safety panel consulted with a structures expert who 
had previously certified hook and pile for use 
restraining cables in the payload bay compartment to 
restrain cables. The recommendation to the panel was 
to have the hook and pile pull-tested in a sufficient 
amount to determine the strength of that particular lot of 
hook and pile and to determine the minimum amount of 
overlap. The structural expert also clarified to the panel 
what cleanliness and procedural verifications should be 
given by the project. Without the assistance of the 
structural expert the safety panel would not have been 
able to resolve what verifications were needed to assure 
an acceptable design. 

2.6. SARJ repair tools 

The Solar Array Rotary Joint (SARJ) repair discussions 
resulted in several repair tools being developed. These 
tools included a large area cleaning wipe (LACW), a 
SARJ Trundle Bearing Assembly (TBA)and Drive Lock 
Assembly(DLA) Bag, an EVA grease gun, and a SARJ 
Debris Container, among other tools. During the safety 
panel review for these tools, some integrated concerns 
were brought up by the panel members that required 
actions be assigned for the project to coordinate with the 
ISS safety review panel and materials experts. This is 
an example of how to receive expert opinions to resolve 
panel concerns when the experts have not been 
coordinated with previous to the safety review. This is 


a valid approach if the safety panel is reviewing the 
hardware in a phased approach, but may impact the 
schedule of the project, particularly if it is a short- 
turnaround project. 

In the case of the SARJ repair tools, the panel requested 
that the project coordinate with the integrator for the 
assessment for the actual SARJ repair. The question 
arose at the panel whether it was possible to have a 
sharp edge on the SARJ ring cut through the EVA wipe. 
Additionally, the panel asked if the grease in the EVA 
grease gun was a contamination problem for the EMU 
or the ISS hardware. The EMU engineers and materials 
experts confinned there were no compatibility issues. 
This led to a follow-up action from the panel regarding 
SARJ contaminants entrained in the grease being 
returned in the SARJ TBA and DLA bag. The materials 
experts confirmed that the contaminants did not result in 
either an off-gassing or flammability hazard once in the 
cabin environment. Although the actions resulted in 
answers prior to the final safety reviews, and resolved 
the issues to the satisfaction of the safety panel, if the 
materials expert had been able to be present at the 
review time would have been saved for the overall 
project schedule. 

2.7. HHM 

The Hand-held Microphone (HHM) provides 
communication ability in 2 fonns. Intercom (Crew to 
crew) and Transmit (Crew to Ground). The HHM is 
used for various activities; including Public Affairs. The 
HHM was recently revised to increased EMI resistance, 
as well as with a detachable cable to fix a stress issue 
which had led to failures. During the re-design and 
build of the HHM, several failures were seen during 
acceptance testing. The safety panel asked the HHM 
project to clarify the cause of the failures, and what 
controls had been added to prevent these failures in the 
future. The failures were caused by the incorrect 
installation of capacitors. The safety panel asked the 
JSC Receiving and Test Facility (RITF) to clarify what 
results they had obtained from examining the failed 
hardware. The RITF representative brought X-rays and 
pointed out where the capacitor had been incorrectly 
installed. This gave the safety panel a better 
understanding of the adequacy of the changes the 
project made to the design drawings and verifications to 
ensure the failure did not re-occur. Additionally, the 
RITF is an independent testing facility which gives the 
safety panel notification of concerns. The HHM review 
was an example of using the resources the RITF has 
available to clarify the verifications available to a 
project and what those verifications entail. 



3. EVA PAYLOADS 
3.1. AMS 

The Alpha Magnetic Spectrometer (AMS) is a state-of- 
the-art particle physics detector. The primary 
component is a cryomagnet which generates a strong 
electromagnetic field. The magnetic field can be 
dissipated, quenched, then recharged if needed. The 
magnetic field has an internal field strength of 8600 
gauss and an external field strength of 2000 gauss. 

When the AMS originally started discussion with the 
Payload Safety Review Panel (PSRP), the EVA 
representative to the PSRP pointed out that the 
Extravehicular Mobility Unit (EMU) could potentially 
be damaged due to a strong magnetic field, losing the 
function of the fan. This results in a lack of flowing 
oxygen, which can overheat the crew and result in 
carbon dioxide build-up. This concern required the 
expertise of the EMU engineers to determine what 
magnetic field strength the EMU was capable of 
withstanding without causing a hazard. Subsequent 
testing resulted in the certification of the EMU to 
300Gauss. Additionally, the EVA Office working with 
the MOD established the nominal EVA translations 
paths near the AMS, and the capacity for remaining far 
enough away from AMS to not expose the EMU to 
greater than 300 gauss. This includes performing 
necessary tasks for ISS hardware maintenance nearby, 
as well as any potential payload operations. 



Figure 2. AMS 


European Technology Exposure Facility, a set of 
scientific payloads located on one of Columbus’s 
external platforms. PLEGPAY is designed to get in- 
flight validation of the plasma contactor as an active 
control for electrostatic discharge. EuTEF was 
deployed on flight IE. Boeing Space environments 
identified three periods after deployment where unusual 
floating potential was witnessed. Floating potential 
(FP) is the difference in electrical potential between the 
International Space Station (ISS) conducting structure 
and the surrounding ionospheric plasma. 



Figure 3. PLEGPAY 

The NASA environments expert was not originally 
consulted by the safety review panel during the pre- 
launch flight safety reviews. Subsequent to the 
identification of the potential for PLEGPay to affect the 
FP, the environments expert came to the safety panel to 
discuss the hazard potential and recommended 
operational controls. 


FP variations could affect the control for electrical 
shock of the EVA crewmembers. If the plasma 
environment potential voltage is more than 40V higher 
than ISS structure, then when the EVA crewmember 
contacts ISS structure with a metallic part of the EMU, 
the electrical potential may arc through the 
crewmember, resulting in loss of the EVA crew. 
Additionally, the EMI/EMC effects on ISS hardware 
and the impact to visiting vehicles may result in a 
hazard. The PLEGPay owners have agreed to remove 
power during EVA operations to ensure no additional 
risk to the EVA crew. 


Although the EVA Office representative to the panel 
could identify that a potential issue was present, with 
out the input of the EMU engineers and the EVA Office 
and MOD EVA this issue could not have been resolved. 
Ideally, the hardware provider will identify an issue like 
this, and the appropriate panel member will identify the 
necessary people to consult as in this example. 

3.2. PLEGPay 

The Plasma Contactor Electrical Grounding Payload 
(PLEGPay) is a scientific experiment that is part of the 


PLEGPay demonstrates the need to consult experts, 
even when an issue is not brought up by the hardware 
provider during the safety review. It behoves a safety 
panel to ask the expert if they have a concern with 
hardware that may impact their area before on-orbit 
operations identify a problem. Any time the ISS 
environment may be impacted, the question should be 
asked even if the hardware provider believes that the 
impact is benign. However, this is an excellent example 
of the experts necessary being consulted to resolve a 
real-time issue with the assistance of the safety panel to 



update the hazard reports so that on-obit operational 
controls can be accurately documented. 

4. ISS HARDWARE 
4.1. Solar Array Repair 

During the STS-116/12A.1 Shuttle/ISS flight, the P6 
solar array being retracted jammed, necessitating an 
EVA to assist in unbinding and retracting the solar 
array. Prior to the STS- 1 17/1 3 A flight, which retracted 
the other P6 solar array, the ISS safety panel discussed 
what controls would be in place to prevent the EVA 
crew from exposure to electrical arcing and sparking, 
with the potential loss of crew due to electrical shock or 
exposure to molten metal. The safety panel asked for 
clarification from the EMU engineers on what testing 
had been performed to verify the isolation the EMU 
glove provides for electrical shock, and asked the 
electrical expert in ISS maintenance whether shunting 
the solar array would provide an additional level of 
protection. . The safety panel concurred with the ISS 
integrator’s recommendation to tape the tools used in 
the solar array operations, with the concurrence of the 
electrical experts. The use of the tape allowed the 
necessary insulation to prevent the electrical charge 
from travelling along the tool to the EVA crewmember. 
The safety panel also asked the electrical environments 
expert to clarify the scenario for what contact could 
result in EVA crew electrical shock. The additional 
recommendation was made to tape the wrist rings of the 
EMU, to remove one potential path for electrical shock. 
This resulted in a discussion of whether additional 
metallic components needed to be taped to reduce the 
risk of electrical shock to the crew. With the assistance 
of the electrical experts, the EMU engineers, and the 
crew who would be perfonning the task on 13 A, it was 
determined no additional taping was required. Without 
the input of these experts, the safety panel would have 
had a difficult time resolving the issues and coming to a 
conclusion for controls with concurrence from all the 
involved organizations. 

5. CONCLUSION 

There are many other examples of when safety panels 
have found it necessary to consult outside experts. The 
important thing to keep in mind when a safety panel 
addresses an issue that requires additional expertise is 
that outside resources are available. Ideally the panel 
representative from the applicable organization will be 
able to reach into that organization and have the expert 
come to the panel meeting to help discuss the issue. 
Alternatively, the safety panel executive officer can ask 
an expert to attend or teleconference in, such as asking a 
oxygen expert from White Sands Test facility to 
participate in a discussion on new hardware being 
located internal to the EMU, a one-hundred percent 
oxygen environment. If the expertise needed is not 


locally available, an expert from another center or from 
outside the space agency should be consulted. Even if 
the panel does not believe there is an issue with the 
hardware, if the hardware involves operations or 
material outside the common use, then the safety panel 
needs to consult the appropriate expert to ensure that 
off-nominal scenario is appropriately analyzed. 



